CVE-2023-33179 MEDIUM

CVE-2023-33179: Sensitive Information Disclosure abusing SQL Injection in Xibo CMS nameFilter

Vendor Xibosignage
Product xibo-cms
Weakness CWE-89 · SQLi
Published May 30, 2023
Last update January 9, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.5 in the `nameFilter` function used throughout the CMS. This allows an authenticated user to exfiltrate data from the Xibo database by injecting specially crafted values for logical operators. Users should upgrade to version 3.3.5 which fixes this issue. There are no known workarounds aside from upgrading.

Key dates

02Disclosure timeline

May 30, 2023 CVE published
January 9, 2025 Record updated